A deployment using 51Degrees has no client hints middleware #1333

One of the additions listed in #777, in the shape of the InMobi Choice module (#1276).

What is wrong

A browser sends its high entropy client hints only when the site asks for them, with Accept-CH on the response, Critical-CH when the first navigation should be retried carrying them, and a Delegate-CH tag or a Permissions-Policy header when a third party is to receive them. A deployment whose device module is 51Degrees prices every first page view of a session on the User-Agent alone unless something writes those headers, and today nothing in the stack does. The stack has a device module for 51Degrees and a loading cache module (#1282, #1319), but no middleware, so the headers have to be written by hand in a deployment's own code.

What changes

A 51degrees.client_hints middleware in crates/middleware/51degrees, and the crate the 51Degrees modules share in crates/shared/51degrees.

• The middleware. A serve middleware that asks the 51Degrees service which hints the reader's browser can send, writes Accept-CH and Critical-CH on every document with that list, writes the Delegate-CH tag in the head and Permissions-Policy for the delegation by header from the same list, and leaves the names in the request state for the device module to read. It runs where a [[serve]] entry names it, and reads critical from its own table ([middleware.51degrees.client_hints]), on by default.
• The shared crate. What every 51Degrees module needs and nothing more, being the vendor's table ([shared.51degrees] with endpoint, timeout_ms, license_key and cache), the one call to the service and its held answer, the evidence keys the service wants, and the cache the answer is held in. The device and loading cache modules read it as the client hints middleware does.
• Maintainers named. Both crates carry their maintainers in their manifests, as every crate outside core does (Record a maintainer for every vendor integration, from the vendor #1100).

Why

Anyone taking the stack with 51Degrees should get the benefit of client hints by naming one entry, as a deployment using InMobi Choice gets its consent prompt by naming one module. The code is the vendor's to maintain and lives in the vendor's crates, and core gains nothing, because the middleware uses the serve phase, the headers step (#1330) and the middleware table that the stack already has.

What breaks

Nothing. A deployment that names no 51degrees.client_hints entry sends no client hints headers, as today.

Where it is

A series on the stack, as a draft on the fork, jwrosewell#39, on top of the modules crate removal (fork pull request 38).